feat(conf) add support for 'transparent' in listeners

[james-callahan]

Requires Kong/openresty-patches#10
Related to https://trac.nginx.org/nginx/ticket/287

[Tieske]

Shouldn't this include the output in the Nginx template (and related tests)?

[james-callahan]

Shouldn't this include the output in the Nginx template (and related tests)?

Tests would fail if the patch is not applied; @thibaultcha mentioned he didn't want them as a requirement if possible.

[Tieske]

hmmm, they would fail if you'd try to use the listeners with that option? but just implementing it in the temnplates and testing whether the template gets the proper flags passed shouldn't be a problem right?

[thibaultcha]

When the patch is not applied to nginx, this option should be disabled, and an error printed to the user that a patch is missing. As of today, we will attempt to start nginx and the configuration loader will fail to parse our nginx.conf, resulting in an obscure error for the user.

[bungle]

One thing about this patch is that it needs usually root privileges to start a Kong. And that is a pretty huge change from the previous. There is also an option to make it work even without root when this is applied (of course by root user):

setcap cap_net_admin=eip /usr/local/openresty/nginx/sbin/nginx

This works at least on Linux and we may need to consider adding it to our distributions when this transparent feature gets applied. Or at least documented. So I leave this as a note here too.

[james-callahan]

When the patch is not applied to nginx, this option should be disabled, and an error printed to the user that a patch is missing.

How can we feature-detect this missing patch?

[thibaultcha]

I was envisioning the patch introducing a new dummy function on the C side, and a protected call to load it via the FFI in our Lua. If the loading fails, we now the patch wasn't applied. Since our CLI runs with the resty interpreter, this would work for our configuration loading phase.
It is a bit hacky, but a price I'd be willing to pay to support vanilla OpenResty with good error messages for the neophytes, in case the patch is not applied (instead of the cryptic nginx configuration parsing error message saying transparent is an unrecognized option.

Anyway, due to our timing constraints, we can merge this as-is and consider the parsing error good enough, so I will be dismissing my review.